Description

Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-27T10:16:38.910Z",
  "pubdate": "2026-08-27T10:16:38.910Z",
  "executiveSummary": "The GeoDirectory plugin, specifically versions 2.8.176 and below, is susceptible to an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability.\nThis vulnerability stems from a failure to implement proper request validation mechanisms, such as nonces or anti-CSRF tokens, within critical plugin functionality.\nAn attacker can exploit this flaw by tricking a logged-in administrator or authorized user into performing unintended actions by clicking a malicious link or visiting a crafted web page.\nBecause the application fails to verify the origin of requests, the attacker can execute arbitrary actions within the context of the victim's session, potentially leading to unauthorized configuration changes, plugin settings modification, or data manipulation.\nThe risk is elevated due to the lack of required authentication for the triggering request, allowing remote attackers to initiate the attack without prior access to the system.\nSuccessful exploitation requires the victim to have an active session with the WordPress administrative dashboard while interacting with the attacker-controlled content.",
  "technicalDetails": "The core of this vulnerability lies in the improper implementation of state-changing request handlers within the GeoDirectory plugin. In versions 2.8.176 and below, the plugin's administrative and configuration interfaces fail to enforce CSRF protection mechanisms.\nSpecifically, the affected components do not utilize WordPress nonces (number used once) or equivalent cryptographic tokens to validate the intent and origin of incoming POST or GET requests. When an administrative function is executed, the application relies solely on the presence of a valid session cookie to authorize the action, neglecting to verify that the request was intentionally initiated from the legitimate plugin interface.\nThe attack flow begins when an attacker crafts a malicious web page or email containing a hidden request directed at the target WordPress site. This request is designed to mimic legitimate administrative actions allowed by GeoDirectory. When a logged-in administrator visits this malicious link, their browser automatically includes the necessary authentication cookies in the background request sent to the GeoDirectory endpoint.\nBecause the server-side code performs no anti-CSRF validation, it interprets the request as legitimate and executes the associated administrative function. Depending on the specific endpoint targeted, an attacker could potentially modify core plugin settings, alter directory configurations, or perform other sensitive actions restricted to authenticated users. The lack of validation effectively bypasses session-based authentication controls, allowing the attacker to perform actions with the privileges of the victim.\nThe vulnerability is exposed over the network, as the target is the web server hosting the WordPress installation. Since the attack is reflected through the victim's browser, the attacker does not need direct network access to the server, provided the victim is authorized to interact with the plugin's administrative settings. Post-exploitation, the attacker may persist their access by modifying configurations to inject malicious scripts, facilitate further privilege escalation, or exfiltrate sensitive site data depending on the plugin's available administrative features."
}